Add Nix flake support for reproducible installs and development

[levonk]

Summary

ACRYL currently provides installers for macOS (DMG), Linux (DEB), Windows (EXE), and a standalone CLI installer (curl | bash). There is no Nix flake, so users on NixOS or with Nix installed cannot:

• nix run github:acryldev/acryl to try ACRYL without installing it
• nix profile install github:acryldev/acryl for a declarative install
• nix develop to get a reproducible development shell
• Pin ACRYL to a specific git tag via flake inputs

This issue proposes adding a Nix flake that exposes both from-source and prebuilt package outputs, a Devbox configuration for reproducible development, and CI to keep the flake from rotting.

Proposed flake outputs

Output	Description
#default / #acryl	TUI built from source (Nix convention)
#prebuilt	Prebuilt CLI release tarball (bundles Node runtime + native addons)
#acryl-desktop	Electron desktop app built from source
devShells.default	Reproducible development shell (Node 22, PNPM 11, esbuild)

Platform support

All 4 standard Nix target systems:

• x86_64-linux (ubuntu-latest)
• aarch64-linux (ubuntu-24.04-arm)
• aarch64-darwin (macos-14)
• x86_64-darwin (macos-13, via nixpkgs-26.05-darwin legacy pin)

nixpkgs-unstable (26.11) dropped x86_64-darwin support. The flake pins nixpkgs-26.05-darwin for Intel macOS, which receives security fixes until end of 2026.

Design decisions

1. Source build as default — follows Nix convention. The prebuilt tarball is available as #prebuilt for users who want the exact release binary (with bundled Node runtime and native addons like node-pty, koffi, sharp).

2. Prebuilt tarball — the CLI release tarballs (acryl-cli-{darwin,linux}-{arm64,x64}.tar.gz) are self-contained: they bundle a Node runtime and all native .node addons. This makes #prebuilt a simple fetchurl + autoPatchelfHook derivation, no build step needed.

3. Desktop from source only — the desktop releases are platform installers (DMG, DEB, EXE), not tarballs. Extracting an .app from a DMG or a binary from a DEB is feasible but more complex; a #prebuilt-desktop output can be added in a follow-up.

4. Devbox with x86_64-darwin workaround — devbox 0.18 ignores nixpkgs.commit for regular package-name resolution and hardcodes nixpkgs 26.11 (which dropped x86_64-darwin). The workaround uses per-package platform scoping: clean package names for normal platforms, flake URL references to nixpkgs-26.05-darwin only for x86_64-darwin.

5. CI with SHA-pinned actions — all third-party GitHub Actions are pinned to 40-character commit SHAs. nix run steps are guarded with if: github.event_name != 'pull_request' to prevent PR-controlled code from reaching GITHUB_TOKEN/OIDC.

Files added

• flake.nix — flake with packages, devShells, and apps outputs
• flake.lock — locked inputs (nixpkgs-unstable + nixpkgs-26.05-darwin)
• devbox.json — reproducible development environment
• devbox.lock — committed lockfile
• .github/workflows/nix.yml — CI for all 4 platforms
• .gitignore — /result, /result-*, .devbox/
• README updates — Nix and Devbox install sections (English + Chinese)

[musichen]

Thanks for the detailed proposal. I resolved PR #5 against current main in 3da7171, retaining both development-log histories.

The merged worktree passes the local headless suite: 806 ACRYL tests and 274 Market tests. The refreshed GitHub Actions matrix is running now; this issue remains tracked by PR #5 until those checks settle.